EUVD-2026-63474

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root...

CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625

VictoriaMetrics vmrestore is vulnerable to a path traversal caused by insufficient validation of backup part path components in lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go. An attacker who can supply or modify a backup source (S3, GCS, Azure Blob Storage, or other) can embed ....

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

CVE-2026-61625 VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...

PT-2026-79061

Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions prior to 1.122.25 VictoriaMetrics versions prior to 1.136.12 VictoriaMetrics versions prior to 1.146.0 Description The vmrestore tool fails to validate backup part path components before writing restored data below...